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Preamble 


The rapid evolution of the electronic marketplace requires an adaptable 
framework for consumer protection that is subject to ongoing review and 
modification in light of changing technologies and market practices. This 
framework should include a blend of voluntary and regulatory approaches and, 
given the global reach of electronic commerce, should be consistent with 
approaches to consumer protection agreed to by the international community. 


The principles in this document are intended to guide the actions of businesses, 
consumers and governments within Canada in the development of a consumer 
protection framework for electronic commerce over open networks, including the 
Internet. These principles are not intended to cover communications conducted 
solely over the telephone. The principles were drafted by a working group of 
representatives from Canadian businesses, consumer associations and govern- 
ments, recognizing that a sound framework for consumer protection will promote 
consumer confidence and facilitate the acceptance and growth of electronic 
commerce. The working group has agreed to review the principles regularly to 
ensure their continued relevance in the rapidly changing electronic marketplace. 


No principle should be interpreted as affording less protection to consumers 
than is already provided for in current laws of general application, particularly 
those applying to trade practices, health and safety, and protection of personal 
information. 
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Guiding Principles a 


Equivalent protection 

“Consumers” should not be afforded any less protection in “electronic commerce” than 
in other forms of commerce. Consumer protection provisions should be designed to 
achieve the same results whatever the medium of commerce. 


Harmonization 

Canadian governments should adapt existing consumer protection laws to apply to 
electronic commerce, and should strive to harmonize provisions across jurisdictions 
without requiring any jurisdiction to lower its standards. 


International consistency ay 
Without compromising the level of protection provided to consumers under the | 
principles in this document or under existing laws, the Canadian consumer protection 
framework should be consistent with directions in consumer protection established by 
international bodies such as the Organisation for Economic Co-operation and 
Development. 


* For clarity, certain terms have been defined and appear in a glossary on page 11. ie : 
The terms appear in quotation marks on their first use in the text. 


A Canadian Framework 


Principles in Summary 


Note: This summary must be read in conjunction 
with the full text of the principles, which follows. 


Principle 1 
Consumers should be provided with clear and sufficient information to make an 
informed choice about whether and how to make a purchase. 


Principle 2 
“Vendors” should take reasonable steps to ensure that the consumer's agreement to 
contract is fully informed and intentional. 


Principle 3 
Vendors and “intermediaries” should respect the privacy principles set out in the 
CSA International's Model Code for the Protection of Personal Information. 


Principle 4 

Vendors and intermediaries should take reasonable steps to ensure that “transactions” 
in which they are involved are secure. Consumers should act prudently when 
undertaking transactions. 


Principle 5 
Consumers should have access to fair, timely, effective and affordable means for 
resolving problems with any transaction. 


Principle 6 
Consumers should be protected from unreasonable liability for payments in 
transactions. 


Principle 7 
Vendors should not transmit commercial E-mail without the consent of consumers, 
or unless a vendor has an existing relationship with a consumer. 


Principle 8 
Government, business and consumer groups should promote consumer awareness 
about the safe use of electronic commerce. 


Principles of Consumer Protection for Electronic Commerce: 


Principle 1: Information Provision 


Hel 


Information should be provided in a form that is clear and understandable to 
the consumer. Vendors should: 


a) avoid using jargon and legalese, and use plain language whenever 
possible; 


b) provide information in a form and manner that allows the consumer to 
keep the information for future reference; 


c) clearly distinguish the terms and conditions of sale from marketing and 
promotional material or messages. 


Information required by these principles should be “prominently disclosed.” 


The following information should be provided to anyone accessing a vendor's 
Web site: 


a) vendor identity, location and any accreditation 


e vendor's legal identity, business name, full street address and 
telephone number (sufficient to enable consumers to verify the 
vendor's legitimacy): 


e an electronic method of verifying any accreditation claims; 

b) any geographic limitations on where a product or service is for sale; 

c) fair and accurate descriptions of products or services for sale; 

d) level of privacy protection (in accordance with Principle 3: Privacy) 
e “personal information” that is being collected and for what purposes; 
e vendor's privacy policy; 

e) security mechanisms available to consumers to protect the integrity and 
confidentiality of the information being exchanged: 


f) complaint procedure 
e how, where and by whom complaints will be handled; 
e any third-party dispute resolution mechanisms to which the vendor 
subscribes, including contact information and any cost: 
q) types of payment that will be accepted, and the implications of each in 
terms of any extra charges or discounts applied by the vendor. 
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Vendors should disclose all terms and conditions of sale to consumers prior 

to the conclusion of any “sales transaction.” These include: 

a) the full price to the consumer, including the currency and any shipping 
charges, taxes, customs duties and customs broker fees and any other 
charges (when unsure of the amount of any potentially applicable 
charges, vendors must disclose to consumers the fact that such charges 
may apply); 

b) delivery arrangements, including timing, cost and method of delivery; 

C) any geographic limitations on where a product or service is for sale; 


d) cancellation, return and exchange policies, warranties if applicable, and 
any associated costs. 


All the terms and conditions of sale should be available in one place. 


Vendors should provide consumers with their own record of the transaction, 
including key details, as soon as possible after the transaction has been 
completed. In a sales transaction, consumers should be able to obtain their 
own record of the completed transaction as proof of purchase and a printable 
record of the terms and conditions of the contract. 


Where there is a delay between the purchase and delivery of goods, or tickets 
for the use of a service (for example, airline or theatre tickets), vendors 
should provide the information set out below to consumers at the time of 
delivery: 


a) cancellation, return and exchange policies, warranties if applicable, 
and any associated costs; 


b) contact information in the event of a complaint; 
c) payment arrangements, including any vendor credit terms; 
d) applicable safety warnings and care instructions. 
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Principle 2: Contract Formation 


_ Vendors should take reasonable steps to ensure that the consumer's _ 
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2.1 Vendors should take reasonable steps to ensure that consumers are aware of 
their rights and obligations under the proposed contract before they agree to 
the contract or provide payment information. 


2.2 Vendors should make clear what constitutes an offer, and what constitutes 
acceptance of an offer, in the context of electronic sales transactions. 


a) Vendors should employ a multistep confirmation process that requires 
consumers to, specifically and separately, confirm the following: 


e their interest in buying; 


e the full price, terms and conditions, details of the order, and method 
of payment; | 


e their agreement to purchase. 


b) [fan appropriate multistep confirmation process, such as that set out 
above, is not used, vendors should allow consumers a reasonable period 
within which to cancel the contract. 


Principle 3: Privacy 


Vendors and intermediaries should respect the privacy principles set 
in the CSA ational’s Model Code for the Protection 


These 10 principles form the basis of the Model Code for the Protection of Personal 
Information (CAN/CSA-Q830-96). 


1. Accountability 

An organization is responsible for personal information under its control and shall 
designate an individual or individuals who are accountable for the organization's 
compliance with the following principles. 


2. Identifying Purposes 
The purposes for which personal information is collected shall be identified by the 
organization at or before the time the information is collected. 


Note: 


3. Consent 
The knowledge and consent of the individual are required for the collection, use or 
disclosure of personal information, except when inappropriate. 


4. Limiting Collection 

The collection of personal information shall be limited to that which is necessary for 
the purposes identified by the organization. Information shall be collected by fair and 
lawful means. 


5. Limiting Use, Disclosure and Retention 

Personal information shall not be used or disclosed for purposes other than those 
for which it was collected, except with the consent of the individual or as required by 
law. Personal information shall be retained only as long as necessary for the 
fulfilment of those purposes. 


6. Accuracy 
Personal information shall be as accurate, complete and up-to-date as is necessary 
for the purposes for which it is to be used. 


7. Safeguards 
Personal information shall be protected by security safeguards appropriate to the 
sensitivity of the information. 


8. Openness 
An organization shall make readily available to individuals specific information 
about its policies and practices relating to the management of personal information. 


9. Individual Access 

Upon request, an:individual shall be informed of the existence, use and disclosure of 
his or her personal information and shall be given access to that information. An 
individual shall be able to challenge the accuracy and completeness of the 
information and have it amended as appropriate. 


10. Challenging Compliance 

An individual shall be able to address a challenge concerning compliance with the 
above principles to the designated individual or individuals accountable for the 
organization's compliance. 


The full text of the Model Code for the Protection of Personal Information (CAN/CSA-0830-96) can be 
obtained from the CSA International Web site (http://www.csa-international.org) or from: 


CSA International 
178 Rexdale Boulevard 
Etobicoke ON MSW 1R3 


Principles of Consumer Protection for Electronic Commerce: 


Principle 4: 
Security of Payment and Personal Information 


Vendors and intermediaries should take reasonable steps to ensure 
( ecure. Consumers 


41 Vendors and intermediaries should safeguard payment and personal 
information that is exchanged and/or stored as a result of a transaction. 


42 Consumers should take reasonable steps to conduct transactions safely 
and securely. 


Principle 5: Redress 


pconsun ets sould JOD access ue fair, Mu effective and CLD 


5.1 Vendors should provide adequate resources to handle consumer complaints 
efficiently and effectively. 


5.2 When internal mechanisms have failed to resolve a dispute, vendors should 
make use of accessible, available, affordable and impartial third-party 
processes for resolving disputes with consumers. However, vendors should 
not require consumers to submit to such processes. 


5.3 Governments, businesses and consumer groups should work together to 
develop appropriate standards for dispute resolution mechanisms. 


5.4 So that consumers are not disadvantaged, governments should cooperate in 
the development of clear rules regarding the applicable law and forum, and 
the mutual enforcement of judgements, in the event of cross-border disputes. 


(oe) 
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Principle 6: Liability 


6.1 


6.2 


6.3 


6.4 


Consumers should not be held liable for amounts billed to them for 
“unauthorized transactions.” Vendors should promptly refund consumer 
payments for unauthorized transactions or sales transactions in which 
consumers did not receive what they paid for. 


Credit card issuers should make reasonable efforts to help consumers resolve 
complaints with vendors in the event of non-delivery or unauthorized 
transactions. 


In inadvertent sales transactions in which consumers acted reasonably, the 
vendor should allow the consumer a reasonable period of time to cancel the 
transaction once the consumer has become aware of it. 


When a consumer disputes a sales transaction in which the vendor failed to 
provide relevant information, the vendor should refund payment provided that 
the consumer returns the good or declines the service within a reasonable 
period of time. 


Principle 7: Unsolicited Commercial E-mail 


Vendors should not transmit commercial E-mail without the consent 


th 
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Principle 8: Consumer Awareness 


Government, business and consumer groups should promote 


8.1 Consumer education and awareness initiatives should highlight those 
circumstances in the use of electronic commerce in which consumers 
are most vulnerable. 


8.2 Consumers should be provided with advice on how to minimize the risks 
associated with electronic commerce. 


8.3 Consumers should be made aware of their rights and obligations with respect 
to vendors. 


8.4 Consumers should take reasonable steps to inform themselves about how to 
conduct transactions safely and securely. 


8.5 Consumers should have access to information identifying disreputable 
electronic commerce practices. 


8.6 Consumers should have access to information identifying those convicted of 
illegal electronic commerce practices. 
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Glossary 


The following definitions apply in Principles of Consumer Protection for Electronic 
Commerce: A Canadian Framework. 


Consumer: an individual who engages in electronic commerce for personal, family or 
household purposes. 


Electronic Commerce: the conduct of commercial activities between vendors and 
consumers and the solicitation of donations from consumers over open networks, 
including the Internet. This definition is not intended to cover communications 
conducted solely over the telephone. 


Intermediaries: third parties facilitating a transaction, including those responsible for 
the storage of information. 


Personal Information: information about an identifiable individual that is recorded in 
any form. 


Prominently Disclosed (with respect to information): easily visible and quickly 
accessible to consumers at the appropriate time. This includes accessibility through 
Clearly labelled hot links. 


Sales Transaction: a transaction involving the buying, selling, leasing or licensing of 
a good or service by electronic commerce. 


Transaction: an electronic commerce transaction 


Unauthorized Transaction: a transaction not authorized by the consumer due to 
theft, fraud or vendor error. 


Vendor: an organization or an individual marketing, selling, leasing or licensing a 
good or service or soliciting donations by electronic commerce. 


1. In other contexts electronic commerce has been more broadly defined as any kind of 
transaction that is made using digital technology, including open networks (the 
Internet), closed networks such as electronic data interchange (EDI), and debit and 
credit cards. 


2. This is the definition used in the Model Code for the Protection of Personal 
Information (CAN/CSA-Q830-96). 
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